morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3537] [Tracker] Audit and subsystem index of active bug reports (October 2026) #1313

New issue

Open

opened 2026-10-16 21:04:06 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-16 21:04:06 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3537

Goal

Provide an exhaustive, evidence-backed tracker of all 361 active open bugs across REA's analysis engines, runtime reconciliation hooks, native decompiler bridges, and core CLI/MCP adapters (audited October 2026).
This centralized index facilitates deduplication, regression fixture authoring, and prioritized scheduling for scoped PRs.
Total active open bugs indexed: 361

Browser, Electron & Web Captures (52 bugs)

#5724 — Page reload during inspection receives installation doctor advice instead of navigation recovery
#5725 — Script-source reads mask the target_changed outcome after a page reload
#5610 — capture-web-screenshot reports complete coverage for an image cropped below the visual viewport
#5609 — observe-web-session returns pre-window lifecycle milestones as observed activity
#5537 — Electron fuse limit refusals return misleading retry and recovery advice
#5530 — CLI token windows duplicate digest characters and corrupt emoji
#5440 — Web runtime partial Evidence reports confirmed cleanup after cleanup commands fail
#5436 — reconcile-javascript-runtime labels validation errors as Electron analysis failures
#5420 — Browser scenarios silently skip storage seeds with an empty Chromium execution-context origin
#5414 — compare-web-captures rejects legacy scenarios without event-family selections
#5413 — Harmony application graph omits inventoried RSA, DSA, and EC signing entries
#5411 — A zero-byte raw/NN_s.txt (session with no response) makes inspect_web_network_capture reject the whole SAZ archive
#5386 — gRPC-web trailer control characters are reported as complete decoding
#5330 — Browser scenario cleanup retry releases the attached target without a late navigation stop
#5266 — Browser scenario start waits for load with no deadline when the page navigates away before load
#5178 — Explicit default-port Inspector and CDP endpoints fail request validation
#5103 — Electron scenario CLI rejects an existing application path after symlink/..
#5075 — Inline literal object spreads erase static WebMCP declaration metadata
#4973 — compare_web_captures / compare_web_screenshots fail in Claude ("problem with that connector")
#4659 — capture-browser-scenario leaves its temporary Chrome profile (cookies, history) and Playwright artifacts directory behind when the process is terminated
#4500 — Electron inspection retains a script from an excluded srcdoc frame under a synthetic local-file sourceURL
#4490 — Destructuring Electron from a Webpack module-table external drops BrowserWindow and IPC (const {BrowserWindow, ipcMain} = external_electron_)
#4425 — inspect-web-page: requests from dedicated workers are not recorded (worker listed as attached, 0 requests)
#4392 — observe_web_session ends a window above 2^31-1 ms almost immediately but reports it as elapsed
#4282 — Linux Electron capture cannot verify owned lineage: Chromium processes do not expose REA_PROCESS_RUN_ID in /proc//environ
#4229 — Loader-alias getter replacement leaves false Electron BrowserWindow evidence
#4089 — Connected browser scenarios can clear caller-owned platform emulation through CDP detach
#4081 — compare_web_captures tool fails to register in Claude Desktop Windows - problem with that connector
#3989 — Dropped WebMCP observations still compare as unchanged
#3987 — An unrelated empty template key erases a literal WebMCP tool name
#3962 — Unrelated join and resolve methods produce false Electron preload declarations
#3960 — Web capture inspection accepts empty containers at nesting level 65 despite its 64-level limit
#3959 — Discarded Cookie values exhaust the retained-header budget and hide ordinary headers
#3947 — Offline HAR inspection is advertised unavailable without a browser provider
#3941 — Unchanged-target navigation events abort web screenshots
#3938 — Advertised screenshot comparison example fails PNG checksum validation
#3936 — Electron action targets use the selection index instead of window identity
#3928 — capture-web-screenshot accepts truncated IHDR bytes as a successful PNG
#3883 — Computed module-table slot write still reports replaced Electron BrowserWindow
#3879 — compare-web-captures reports scripts unchanged when retained source digests differ
#3878 — Passive browser captures drop the URL fragment from target, frame, and session URLs
#3868 — Process capture rendered lines gain an extra blank cell after wide characters
#3865 — Rejected Electron CLI inputs omit which argument was wrong and why
#3671 — resource_constraint application_projection_failure reports required bytes far below the budget; per-file Electron findings missing from graph (VSCodium 1.140)
#3597 — Website header navigation wraps onto a second line
#3551 — Renaming a Webpack factory's module parameter silently drops CommonJS exports
#3535 — Electron reached through esbuild's __require shim is invisible (0 windows / 0 IPC on esbuild-bundled main processes)
#3474 — capture_electron_scenario active hook does not block or record shell.trashItem
#3452 — capture_electron_scenario does not block app.moveToApplicationsFolder; the target moved the operator's Electron runtime into /Applications
#3414 — Owned Electron capture drops the selected X11 authorization path
#3380 — Electron fuse inspection rejects absolute symlinks inside the framework
#3360 — Unrelated this receivers share one resolved event identity

Ghidra, Hopper, IDA & Native Decompilation (78 bugs)

#5713 — Native target admission rejects valid thin arm64_32 Mach-O files
#5714 — Hopper cancellation errors discard the caller abort reason
#5715 — inspect-binary-layout fails on a valid ELF containing IKCFG_ST
#5716 — inspect-binary-layout classifies an overflowing ELF program-header offset as execution_failure
#5717 — inspect-binary-layout rejects a valid relocatable object referencing linux_banner
#5718 — inspect-binary-layout allocates the declared BSS and fails on a small valid ELF
#5691 — Objdump launch failures recommend changing the target or fixing read access
#5696 — trace-dylib-resolution skips a loadable platform-less dylib and its required dependencies
#5697 — inspect-signature still fails on mixed ad hoc signed universal Mach-O after #701
#5700 — Recorded-crash inspection applies CORE note names to GNU-owned notes
#5707 — Protocol properties are silently omitted from dispatch metadata
#5708 — inspect-macho misclassifies a valid dSYM target refusal as a provider execution failure
#5429 — startup cancellation replaces an observed launcher exit
#5682 — Swift dispatch metadata loses enclosing type and module names
#5607 — get_objc_classes counts imported Objective-C classes twice through GOT aliases
#5580 — get_objc_protocols counts Objective-C method labels containing _TtP as protocols
#5576 — analyze_swift_types counts Objective-C labels containing _Tt as Swift observations
#5552 — demangle-swift reports an omitted record as demangled and fails mixed batches
#5547 — DMG inspection guidance directs callers to unsupported extraction
#5542 — FAT target admission trusts CPU declarations that contradict thin Mach-O headers
#5535 — compare_functions reports false call and reference changes for Hopper's generated EntryPoint label
#5503 — trace_feature drops Hopper string encoding and termination qualifications
#5475 — Clearing a Hopper bookmark name reports success but retains the previous name
#5474 — trace_crash advertises its provider document selector as Hopper-specific
#5468 — Managed/native verification rejects inspection Evidence with an empty P/Invoke import name
#5462 — Native inspection admits universal static archives as Mach-O images
#5447 — Session discovery falsely requires open_binary for independent Cutter and debugger tools
#5442 — Hopper procedure tools return another procedure for a non-entry symbol without explaining containment
#5438 — Hopper reverse caller queries omit a resolved direct tail call
#5434 — Missing working directory leaves native observation cleanup stuck until MCP restart
#5433 — trace-native-values hides the provider reason when its seed selector fails
#5424 — Dispatch-metadata symbol fallback turns Ghidra pointer/string labels into fake Objective-C classes and misses every class the binary defines
#5398 — Missing CLI arguments expose raw validator details instead of documented guidance
#5385 — LLDB exit failure and no-target proof are lost to cancellation during cleanup
#5381 — PATH-discovered Ghidra registration pins a versioned Cellar root
#5362 — Dylib path expansion rejects line terminators in dependency names and rpaths
#5342 — Server-wide REA_GHIDRA_DISABLED_ANALYZERS naming a format-specific analyzer stops other formats from opening
#5338 — Paging a retained artifact inventory re-validates the whole inventory on every page
#5331 — Failed GDB startup leaves a retained cleanup session reported ready and accepting gdb_console
#5306 — observe_native_ui treats a wrong PID or window as provider unavailability and withdraws the tool in binary_session
#5298 — inspect-macho and observe-native-calls name the same Mach-O function differently (_main vs main)
#5099 — Inspecting inferior-tty permanently revokes persistent GDB session TTY verification
#5098 — debug-with-gdb rejects built-in p, s and d aliases before starting GDB
#5088 — inspect_evm_interface loses detail field guidance and advertised default
#5085 — Korean update guide omits the documented alias and output-limit guidance
#4921 — Hopper (Linux): session teardown leaves a stale /tmp/.X-lock; accumulated locks can make startup fail with address_collision
#4860 — IDA regex searches block cancellation on the service thread
#4588 — Linux Ghidra bridge cannot start where the sandbox refuses socket(AF_UNIX)
#4505 — Windows native handle finalization discards failed close ownership
#4445 — NativeAOT metadata recovery finds no MethodTables in a real 26 MB .NET 8 app: the fixed 64M work-unit budget runs out mid-discovery
#4383 — Direct protocol enumeration discards input before strict validation
#4375 — Hopper startup diagnostics disappear beside generic error diagnostics
#4368 — Empty Swift conformance names escape entry recovery and invalidate dispatch metadata
#4296 — analyze_swift_types puts constrained-extension members under structs
#4226 — Hopper pre-handshake startup failure causes repeated cleanup errors while session reports idle
#4202 — Arithmetic native-addon assignments are reported as direct re-exports
#4177 — Ghidra pseudocode shows musl stdio streams as NULL: copy-relocated stderr in RELRO is folded to its on-file zero
#4055 — verify_managed_native_boundaries counts delegate (runtime-provided) methods as unresolved native bodies
#3992 — Failed IDA decompilation drops the known profile from partial Evidence
#3988 — Missing IDA callee coverage produces a definite negative call-path result
#3985 — Hopper close succeeds while a timed-out probe remains alive after failed cleanup
#3954 — Process capture preparation prompt returns execution-oriented guidance
#3930 — Explicit Ghidra profile refusal omits provider-selection diagnostics
#3894 — Piped --json validation errors are truncated at 512 bytes and fail to parse
#3885 — Optional require call loses its native-addon binding record
#3884 — Local require method creates a resolved native-addon binding
#3870 — Hopper ordinary executable opens can attribute replacement bytes to the original digest
#3578 — Hopper 6.6.0 Fedora feed main_exe_hash disagrees with the signed RPM launcher
#3556 — rea update reports success without exposing an unavailable Frida native binding
#3543 — macOS demangle validation test exceeds 20s after emitting VALIDATION_ERROR
#3509 — Open target lost after MCP transport failure; Ghidra analyses longer than the client's idle timeout can never complete (stdio)
#3397 — Unnamed ELF read-only sections lose embedded Rust compiler-path evidence
#3365 — Native-boundary inspection fails on a large metadata issue inventory
#3351 — Managed/native verification contradicts Windows module paths on macOS
#3322 — Frida close omits foreign execution from advertised effects
#3056 — Windows + IDA headless: analysis hangs for minutes and ends in cleanup_incomplete; the same supervisor driven directly answers in 2.4s
#1701 — Windows native authority self-test fails on real Windows: "Delete owned object by handle failed" (Win32 5), and leaves probe directories behind
#479 — Reuse Hopper GUI windows across REA sessions for the same target

Android, ADB & Mobile Runtimes (10 bugs)

#5689 — inspect-adb-client hides execution failures behind a version diagnostic
#5690 — Apktool version-output overflow is reported as an unusable launcher
#5426 — inspect_adb_package reports user_id null on Android 16 because dumpsys prints appId instead of userId
#5259 — REA 6.7.0 fails to start on Windows: ERR_MODULE_NOT_FOUND for MCP client index.mjs
#5177 — Apktool reports an existing non-executable launcher as missing
#5160 — Codex + kimi-k3: older REA schemas trigger misleading recursion errors; recovery guidance missing
#5096 — Windows JADX selects a current-directory java.exe before the selected PATH JDK
#5093 — start-adb-activity rejects valid empty-string intent extras before provider admission
#3369 — ADB push reports checksum capture overflow as device unavailability
#3111 — [Windows] Native controls self-check blocks static Android APK analysis on Win11 build 26300 (rea-agents 6.4.0)

CLI, MCP Protocol & Agent Integration (27 bugs)

#5711 — binary_session advertises pcap capture inspection as available on macOS
#5659 — Firmware publication timeout can crash the CLI before returning its timeout result
#5532 — Negative and fractional token-window values produce inconsistent pages
#5528 — rea mcp shell completion suggests unrelated root commands
#5527 — Bash completion fails to register in macOS system Bash
#5526 — Bash completion omits documented global options
#5525 — CLI --format md replaces nested inventory facts with [object Object]
#5493 — MCP input schemas omit host-absolute local path constraints
#5452 — CLI artifact bundle leaves its linked inventory ID unresolved after import
#5450 — MCP bundle comparison accepts relative paths and reads from the server working directory
#5448 — CLI --filter-output removes failure diagnostics and prints an empty object
#5397 — Process CLI file errors omit required machine-readable error fields
#5273 — MCP tool calls backgrounded by the client after 120 s fail with "missing required resultType" (protocol 2026-07-28)
#5244 — Bundled skill v42 documents MCP tools absent from npm 6.7.0 server
#5201 — Gemini-backed clients still reject the whole tool catalog: advertised empty-string const in trace_application_feature.seed.value serializes as an empty enum member
#5147 — inspect-managed-members anchors omit operand-free instructions such as ldc.i4.N
#5110 — Exhausted CLI failure token windows display a reversed range
#5107 — CLI Evidence comparison cannot accept explicit observation pairs
#4620 — Gemini CLI throws error 400 'INVALID_ARGUMENT' when using REA skill
#3924 — MCP JavaScript application analysis accepts a relative input_path
#3690 — MCP npx launcher fails on unrelated workspace overrides (EOVERRIDE; observed in OpenCode v2)
#3408 — Array and object tool parameters rejected when REA runs as a local MCP server in Claude Desktop (Windows)
#3335 — analyze_function repeats the initial MCP progress number
#2999 — WorkBuddy/CodeBuddy-backed gateway rejects the whole tool catalog with HTTP 400 code 11133 on the default profile; REA_MCP_INPUT_SCHEMA_PROFILE=compact fixes it
#1685 — perf(mcp): reduce Windows startup module-resolution I/O
#1554 — Full MCP input catalog blocks ordinary Copilot CLI chat with gpt-4.1 metadata
#1065 — [Feature] Roadmap: improve MCP usability and performance under bounded resources

Evidence, Artifacts, Firmware & Reconstruction (165 bugs)

#5719 — SQLite generated-column evaluation failures blame the database path
#5720 — decode-interface-builder reports keyed AppKit action connectors as UI controls
#5721 — Keyed nib decoding reports placeholder classes instead of authored classes
#5727 — Unread archive members lose known bundle plist and signing paths
#5692 — decode-interface-builder labels an archived outlet-collection destination missing or external
#5693 — Compiled AppKit nib hierarchies omit top-level custom objects while reporting complete coverage
#5695 — Compiled storyboard segues lack connections while connection coverage reports complete
#5698 — inspect-asset-catalog reports a malformed catalog as an I/O failure and drops its diagnostic
#5701 — inspect-plist rejects a valid binary plist containing a control character and data
#5702 — inspect-plist rewrites Unicode separators as LF when XML fallback is used
#5703 — inspect-plist silently drops fractional seconds from binary plist dates
#5705 — inspect-plist still loses negative-zero sign through XML fallback after #4839
#5710 — analyze-javascript-application still counts exposed const-channel sends twice after #5586
#5687 — inspect-artifact rejects mountable raw UDRW DMGs as unsupported binaries
#5656 — Missing console API timestamps are reported as epoch zero
#5648 — Backward JavaScript provenance loses a property passed directly as a call argument
#5641 — Cancellation projection replaces incomplete retained observations with unreadable_output
#5638 — inspect-keyed-archive reports ordinary UID dictionaries as resolved references
#5635 — inspect-asset-catalog omits AppKit NSCustomResource image references
#5632 — Flutter file budgets and Go report refusals give recovery that cannot admit the same input
#5631 — Fixed capture budgets recommend changing worker or host memory
#5630 — IL2CPP reader occupancy is reported as a non-retryable memory failure
#5628 — Typed WASM interface decoding tells callers to retry a fixed representation budget
#5620 — Reference-source manifests change after relocation when a file is unreadable
#5619 — Reference-source import excludes files that Git leaves unignored with core.ignorecase=false
#5616 — PR #5587 removes compiler scratch roots before inherited-pipe children exit
#5595 — analyze selects the wrong workflow for bundle aliases and JavaScript directories named .app
#5589 — Resource inspection rejects app bundles without CFBundleExecutable
#5585 — Backward JavaScript provenance loses the value of a directly returned property
#5549 — inspect-artifact recommends an ineffective integrity-policy retry for checksum-invalid DMGs
#5546 — inspect-artifact discards root observations when a DMG is already mounted
#5541 — decode-interface-builder reverses boolean values in compiled AppKit nibs
#5540 — decode-interface-builder misattributes object-limit omissions to the connection budget
#5538 — inspect-signature lists completed signing captures as an outstanding limitation
#5531 — Invalid output-flag values emit TOON despite selecting JSON or JSONL
#5521 — Artifact commands describe a stable symlink loop as a target change
#5520 — SQLite malformed-database errors omit the selected file path
#5513 — Desktop inspection classifies invalid and unreadable targets as execution failures
#5507 — trace_feature promises an operation count absent from successful results
#5506 — WASM comparison budget refusals incorrectly tell callers to retry
#5505 — Rust report-budget refusals recommend recovering Evidence that was never produced
#5504 — Rust compiler-hash capacity refusals incorrectly tell callers to retry
#5502 — Cancelled JavaScript analysis can still leave the macOS helper's temporary folder after #1194
#5492 — inspect-plist --relative-path reads the wrong file when .. follows a directory symlink
#5480 — Evidence export fails for valid long output paths and can leave empty staging directories
#5479 — inspect-artifact loses the caller-selected symlink path from complete Evidence
#5469 — JavaScript application analysis reports complete coverage for source maps missing mappings
#5466 — JavaScript application analysis misreports external source-map sections as version mismatches
#5465 — Export shape comparison gives a selected export an unexplained unknown reason
#5464 — JavaScript summary coverage mixes examined modules with total graph nodes
#5460 — IL2CPP report-budget refusals recommend worker and host memory changes
#5459 — Analysis-view projection budget refusals recommend increasing worker memory
#5456 — SQLite reply-budget refusals recommend recovering Evidence that was never produced
#5449 — trace-application-feature reports changed Evidence as a retryable input error
#5445 — A one-element initialize batch replaces the active HTTP session
#5439 — uninstall reports valid Cordis YAML as invalid when an entry ID is an expression
#5437 — Malformed attachment state hides all Inspector targets and blocks sibling observation
#5423 — Signature inspection omits its temporary filesystem-write effect from discovery
#5421 — Popup startup misses declared storage seeds while capture reports complete
#5418 — Process capture blames normalization for unchanged rendered-frame omissions
#5416 — macOS process exit is counted as a sampling read failure
#5412 — Bare-name managed type selection omits a nested type with a namespace
#5408 — inspect-artifact suggests overwrite recovery but rejects --overwrite
#5407 — Selecting every JavaScript source warns about nonexistent unselected sources
#5406 — compare-application-versions pairs unresolved endpoints by equal expression text
#5405 — Rust and IL2CPP input-size refusals recommend increasing evidence-output limits
#5404 — list-architectures rejects universal Mach-O files without a host-compatible slice
#5403 — IL2CPP metadata with a missing version reports unrecognized magic
#5402 — Incomplete firmware ranges omit the missing argument from error details
#5401 — inspect-with-objdump loses missing-file and directory failure reasons
#5399 — Reference-source import root errors omit required machine-readable fields
#5396 — Duplicate record_unknown calls are reported as retryable revision conflicts
#5395 — WASM debug-name collisions hide an exported function signature change
#5393 — JavaScript analysis worker replaces an observed failing exit with later cancellation
#5388 — Source-map cancellation loses observed codec failures and the caller abort reason
#5377 — JavaScript call graph resolves a callback before its var initializer executes
#5333 — inspect-go-binary returns build_info null when the PE data section has VirtualSize 0
#5332 — EVM artifact-read cancellation returns the ArtifactReaderFailure wrapper instead of the caller's abort reason
#5302 — Export return shapes give a var read before its initializer the initializer's value
#5294 — SQLite cleanup errors retain markers after root release
#5286 — SQLite provider returns success when cancelled during final root cleanup
#5229 — One unreadable entry fails directory analysis, and inventory omissions leave the application graph complete
#5218 — UIKit view-controller subclasses decode as controls
#5206 — Process exit refresh can discard reparented descendants and report cleanup complete
#5195 — compare-application-versions reports unchanged module exports as removed and added
#5191 — Inconsistent format names, collapsed slice names and raw platform codes across the binary tools
#5176 — Non-DWARF objdump facets return an inapplicable DWARF debug-link warning
#5168 — e_lfanew inside the DOS header (Tiny PE) is refused before provider admission
#5146 — inspect-managed-members returns unavailable on a 2042-type .NET app and offers no way to list its types
#5111 — Empty asset inventory is marked truncated at a positive offset
#5109 — Late-cancelled document selection drops the known analysis profile from Evidence
#5108 — inspect-artifact loses original decomposed Unicode member names
#5102 — Managed member inspection labels truncated compressed parameter counts as reserved
#5100 — WASM summary requests enter the provider before refusing a fixed server without Evidence retention
#5090 — debug-with-rizin retains failure exit status after fallback cleanup succeeds
#5087 — EVM inspection reports a fixed 3 GiB address-space limit after selecting a tighter inherited limit
#5086 — EVM discovery reports available when its required prlimit executable is absent
#5080 — find_changed_behavior description omits supported function comparison Evidence
#5077 — Error catalogue marks a removed 64 MiB process-input limit as implemented
#5076 — Go inspection reports successful Evidence for a 64-bit Mach-O with a misaligned load command
#5074 — objectValue JSDoc describes endpoint selection instead of property lookup
#5050 — Wall-clock deadline regression test cancels healthy captures on the macOS lane
#4989 — Windows update command surface test intermittently exceeds its deadline
#4943 — [Enhancement] Add XEX support
#4885 — SIGINT or SIGTERM during the initial target open kills REA without closing its session
#4657 — macOS: Homebrew keg-only JDK is never tried when /usr/bin/java is present (follow-up to #4556)
#4630 — Array-element setter writes leave stale exported return literals
#4558 — firmwareIntegration publication cleanup-retry tests fail deterministically since 2d163c12
#4509 — Leading whitespace in ESM specifiers creates false resolved local imports
#4494 — draw.io ASAR capture opens an invalid-file dialog before declared actions
#4477 — Omitted JSON request bodies are reported as complete body-shape coverage
#4474 — WASM glue still uses unnamed TypeScript parser for valid JavaScript
#4436 — Unmodified 6.5.0 Evidence bundles are rejected on main as an integrity mismatch: records with relationship_coverage: null changed identity
#4385 — Bundle Evidence omits the effective default origin scope
#4382 — Reference source graphs omit CommonJS dependencies written as static templates
#4380 — Partial Inspector warning counts duplicate drafts as separate locations
#4377 — Snapshot import returns zero new entries after retaining a workflow result
#4370 — A method ending in volatile. receives a complete decoded-CIL fingerprint
#4322 — Linux exit race reports an exited owned process as a token mismatch
#4293 — Universal Mach-O signatures report one slice as the whole file
#4269 — Escaped ESM pathnames select the wrong historical dependency
#4212 — Source-map edges target known directory containers
#4211 — Omitted initiator URLs cause unsupported passive network comparison results
#4201 — WASM optional-file failures identify the primary module argument
#4197 — Go and Rust binary inspection omit the canonical PowerPC subject architecture
#4189 — Trailing-slash CommonJS require ignores package main in reference import
#4184 — Unrelated SQLite catalog names exhaust selected-table reply budget
#4175 — extract_firmware reports Unblob-rewritten symlink targets as the firmware's link targets
#4168 — Export shape comparison reports "changed" for a branch that a known constant never takes
#4003 — Process capture leaves endpoint ports numeric when port normalization is enabled
#3991 — Duplicate byte-string CBOR metadata keys receive decoded status
#3957 — Omitted failed or unfinished responses undercount selected response-content events
#3955 — Version comparison accepts managed static facts with runtime locations
#3945 — Query-bearing TypeScript source URLs receive JavaScript media types
#3943 — Package inspection returns absent installer as the string null
#3937 — Reconstruction coverage ignores contradictions on required claim surfaces
#3916 — query-bearing ESM imports miss inventoried modules
#3910 — passive inspection omits frames created during observation
#3908 — project-open refusals replace the artifact path with the endpoint
#3907 — Vite dependency arrays resolve the wrong file after a spread
#3890 — Reconstruction coverage ignores authority routing on surfaces named only by a required claim
#3889 — Reconstruction coverage reports ready when a passing proof conflicts with a failed one
#3888 — Firmware extraction byte budget also caps the mandatory producer report
#3882 — HTML script URLs ending in / or /. resolve to a same-named regular file
#3877 — Wrong-kind managed member signatures are reported decoded with complete coverage
#3874 — Literal POSIX names beginning with a letter and colon abort artifact inventory and extraction
#3839 — Getter-result expansion grows combinatorially and crashes semantic analysis of a shipped bundle
#3804 — Language-picker arrow is small, misaligned, and does not reflect open state
#3767 — DOS MZ: table-dispatched handlers are invisible to procedure tools (352 of 540 functions)
#3629 — inspect_dart_aot rejects libapp.so built after Dart renamed its snapshot symbols (_kDartSnapshotText/_kDartSnapshotData)
#3538 — Parent-budget exhaustion after a static checkpoint advises "retry with sufficient memory"
#3401 — Unreadable reference source root loses its filesystem permission diagnostic
#3398 — An unrelated .go.buildinfo section blocks Rust dependency inspection
#3391 — Accepted scenario_start action creates duplicate capture step IDs
#3390 — Mach-O export inspection merges names ending in carriage return
#3387 — Empty module specifier aborts the entire historical-source inventory
#3384 — Mach-O dependency inspection removes install-name whitespace
#3377 — Selected console text drops null primitive arguments
#3370 — Reconstruction obligation ledgers lose semantic unknowns and report complete coverage
#3367 — Replaced globals retain resolved built-in timer, fetch, and JSON.parse effects
#3354 — Reconstruction coverage reports ready with a missing transitive dependency
#3348 — Managed member comparison reports changed method headers as unchanged
#3343 — UI action traces omit known Objective-C handlers for non-controller receivers
#3338 — Process capture silently drops the accepted proto environment override
#2228 — REA 不能直接解析 .jsc

Setup, Doctor & Environment Configuration (29 bugs)

#5723 — Windows native module rea-windows-x64.node blocked by Smart App Control
#5568 — Kuna doctor cancellation test times out during preceding provider startup
#5522 — environment-export reports a later nested-file path-length failure as invalid input
#5515 — decode_signal_recording: a misspelled decoder or annotation class returns execution_failure with "Run rea doctor", which has no sigrok check
#5512 — Pinned mcp__claude__ prefix in a Claude Code fork hides REA from the model while doctor stays green
#5458 — environment-export reports read access denied for an unwritable output directory
#5457 — environment-export reports an identity change when its destination is an existing file
#5455 — environment-serve suggests changing ports for host lookup failures
#5451 — JEB discovery omits recovery guidance when the configured endpoint is unreachable
#5446 — Ambiguous provider selection offers providers already rejected as unconfigured
#5443 — Setup with --all-detected silently omits an explicitly selected undetected client
#5441 — Setup rewrites aligned Cursor registration when switching equivalent launcher paths
#5435 — MCP doctor emits indented JSON when stdout is redirected
#5264 — Setup pins JAVA_HOME to a versioned Homebrew Cellar path that breaks after a JDK upgrade
#5245 — 6.7.0 flags previously working extracted Hopper demo as unsupported_hopper_build
#5113 — Hopper setup fails on vanilla Arch when zlib-ng-compat provides zlib (docs scope this to CachyOS only)
#5078 — Host-support error catalogue omits Omarchy and understates doctor support
#4847 — Setup registers a version-specific entrypoint that breaks after a mise upgrade
#4625 — OMP path guidance does not distinguish PI_CONFIG_DIR's home-relative base
#4624 — CLI guide excludes Kuna from supported doctor providers on main
#4278 — setup can't register Claude Desktop when the MSIX build has no package-private config
#3944 — Windows setup recovery recommends an unsupported Hopper installation
#3939 — Nested HERMES_HOME roots use another root's active profile during setup
#3863 — rea setup deletes Codex per-tool approval settings when refreshing the registration
#3862 — rea doctor marks a Codex registration invalid when it has per-tool approval settings
#3419 — Setup offers automated Hopper installation on Linux arm64, but every pinned Hopper package is x86_64
#3325 — Hermes setup cannot refresh a REA anchor referenced by another server
#3320 — Hermes setup fails to register REA through an aliased MCP server table
#3318 — OpenCode V2 registration stays disabled after setup refresh

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3537 [![Type: Tracker](https://img.shields.io/badge/type-tracker-purple.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Active Audit](https://img.shields.io/badge/status-active_audit-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Goal Provide an exhaustive, evidence-backed tracker of **all 361 active open bugs** across REA's analysis engines, runtime reconciliation hooks, native decompiler bridges, and core CLI/MCP adapters (audited October 2026). This centralized index facilitates deduplication, regression fixture authoring, and prioritized scheduling for scoped PRs. **Total active open bugs indexed:** 361 --- ### Browser, Electron & Web Captures (52 bugs) - [ ] #5724 — Page reload during inspection receives installation doctor advice instead of navigation recovery - [ ] #5725 — Script-source reads mask the target_changed outcome after a page reload - [ ] #5610 — capture-web-screenshot reports complete coverage for an image cropped below the visual viewport - [ ] #5609 — observe-web-session returns pre-window lifecycle milestones as observed activity - [ ] #5537 — Electron fuse limit refusals return misleading retry and recovery advice - [ ] #5530 — CLI token windows duplicate digest characters and corrupt emoji - [ ] #5440 — Web runtime partial Evidence reports confirmed cleanup after cleanup commands fail - [ ] #5436 — reconcile-javascript-runtime labels validation errors as Electron analysis failures - [ ] #5420 — Browser scenarios silently skip storage seeds with an empty Chromium execution-context origin - [ ] #5414 — compare-web-captures rejects legacy scenarios without event-family selections - [ ] #5413 — Harmony application graph omits inventoried RSA, DSA, and EC signing entries - [ ] #5411 — A zero-byte `raw/NN_s.txt` (session with no response) makes `inspect_web_network_capture` reject the whole SAZ archive - [ ] #5386 — gRPC-web trailer control characters are reported as complete decoding - [ ] #5330 — Browser scenario cleanup retry releases the attached target without a late navigation stop - [ ] #5266 — Browser scenario start waits for load with no deadline when the page navigates away before load - [ ] #5178 — Explicit default-port Inspector and CDP endpoints fail request validation - [ ] #5103 — Electron scenario CLI rejects an existing application path after symlink/.. - [ ] #5075 — Inline literal object spreads erase static WebMCP declaration metadata - [ ] #4973 — compare_web_captures / compare_web_screenshots fail in Claude ("problem with that connector") - [ ] #4659 — capture-browser-scenario leaves its temporary Chrome profile (cookies, history) and Playwright artifacts directory behind when the process is terminated - [ ] #4500 — Electron inspection retains a script from an excluded srcdoc frame under a synthetic local-file sourceURL - [ ] #4490 — Destructuring Electron from a Webpack module-table external drops BrowserWindow and IPC (`const {BrowserWindow, ipcMain} = external_electron_`) - [ ] #4425 — inspect-web-page: requests from dedicated workers are not recorded (worker listed as attached, 0 requests) - [ ] #4392 — observe_web_session ends a window above 2^31-1 ms almost immediately but reports it as elapsed - [ ] #4282 — Linux Electron capture cannot verify owned lineage: Chromium processes do not expose REA_PROCESS_RUN_ID in /proc/<pid>/environ - [ ] #4229 — Loader-alias getter replacement leaves false Electron BrowserWindow evidence - [ ] #4089 — Connected browser scenarios can clear caller-owned platform emulation through CDP detach - [ ] #4081 — compare_web_captures tool fails to register in Claude Desktop Windows - problem with that connector - [ ] #3989 — Dropped WebMCP observations still compare as unchanged - [ ] #3987 — An unrelated empty template key erases a literal WebMCP tool name - [ ] #3962 — Unrelated join and resolve methods produce false Electron preload declarations - [ ] #3960 — Web capture inspection accepts empty containers at nesting level 65 despite its 64-level limit - [ ] #3959 — Discarded Cookie values exhaust the retained-header budget and hide ordinary headers - [ ] #3947 — Offline HAR inspection is advertised unavailable without a browser provider - [ ] #3941 — Unchanged-target navigation events abort web screenshots - [ ] #3938 — Advertised screenshot comparison example fails PNG checksum validation - [ ] #3936 — Electron action targets use the selection index instead of window identity - [ ] #3928 — capture-web-screenshot accepts truncated IHDR bytes as a successful PNG - [ ] #3883 — Computed module-table slot write still reports replaced Electron BrowserWindow - [ ] #3879 — compare-web-captures reports scripts unchanged when retained source digests differ - [ ] #3878 — Passive browser captures drop the URL fragment from target, frame, and session URLs - [ ] #3868 — Process capture rendered lines gain an extra blank cell after wide characters - [ ] #3865 — Rejected Electron CLI inputs omit which argument was wrong and why - [ ] #3671 — resource_constraint application_projection_failure reports required bytes far below the budget; per-file Electron findings missing from graph (VSCodium 1.140) - [ ] #3597 — Website header navigation wraps onto a second line - [ ] #3551 — Renaming a Webpack factory's module parameter silently drops CommonJS exports - [ ] #3535 — Electron reached through esbuild's `__require` shim is invisible (0 windows / 0 IPC on esbuild-bundled main processes) - [ ] #3474 — capture_electron_scenario active hook does not block or record shell.trashItem - [ ] #3452 — capture_electron_scenario does not block app.moveToApplicationsFolder; the target moved the operator's Electron runtime into /Applications - [ ] #3414 — Owned Electron capture drops the selected X11 authorization path - [ ] #3380 — Electron fuse inspection rejects absolute symlinks inside the framework - [ ] #3360 — Unrelated this receivers share one resolved event identity ### Ghidra, Hopper, IDA & Native Decompilation (78 bugs) - [ ] #5713 — Native target admission rejects valid thin arm64_32 Mach-O files - [ ] #5714 — Hopper cancellation errors discard the caller abort reason - [ ] #5715 — inspect-binary-layout fails on a valid ELF containing IKCFG_ST - [ ] #5716 — inspect-binary-layout classifies an overflowing ELF program-header offset as execution_failure - [ ] #5717 — inspect-binary-layout rejects a valid relocatable object referencing linux_banner - [ ] #5718 — inspect-binary-layout allocates the declared BSS and fails on a small valid ELF - [ ] #5691 — Objdump launch failures recommend changing the target or fixing read access - [ ] #5696 — trace-dylib-resolution skips a loadable platform-less dylib and its required dependencies - [ ] #5697 — inspect-signature still fails on mixed ad hoc signed universal Mach-O after #701 - [ ] #5700 — Recorded-crash inspection applies CORE note names to GNU-owned notes - [ ] #5707 — Protocol properties are silently omitted from dispatch metadata - [ ] #5708 — inspect-macho misclassifies a valid dSYM target refusal as a provider execution failure - [ ] #5429 — startup cancellation replaces an observed launcher exit - [ ] #5682 — Swift dispatch metadata loses enclosing type and module names - [ ] #5607 — get_objc_classes counts imported Objective-C classes twice through GOT aliases - [ ] #5580 — get_objc_protocols counts Objective-C method labels containing _TtP as protocols - [ ] #5576 — analyze_swift_types counts Objective-C labels containing _Tt as Swift observations - [ ] #5552 — demangle-swift reports an omitted record as demangled and fails mixed batches - [ ] #5547 — DMG inspection guidance directs callers to unsupported extraction - [ ] #5542 — FAT target admission trusts CPU declarations that contradict thin Mach-O headers - [ ] #5535 — compare_functions reports false call and reference changes for Hopper's generated EntryPoint label - [ ] #5503 — trace_feature drops Hopper string encoding and termination qualifications - [ ] #5475 — Clearing a Hopper bookmark name reports success but retains the previous name - [ ] #5474 — trace_crash advertises its provider document selector as Hopper-specific - [ ] #5468 — Managed/native verification rejects inspection Evidence with an empty P/Invoke import name - [ ] #5462 — Native inspection admits universal static archives as Mach-O images - [ ] #5447 — Session discovery falsely requires open_binary for independent Cutter and debugger tools - [ ] #5442 — Hopper procedure tools return another procedure for a non-entry symbol without explaining containment - [ ] #5438 — Hopper reverse caller queries omit a resolved direct tail call - [ ] #5434 — Missing working directory leaves native observation cleanup stuck until MCP restart - [ ] #5433 — trace-native-values hides the provider reason when its seed selector fails - [ ] #5424 — Dispatch-metadata symbol fallback turns Ghidra pointer/string labels into fake Objective-C classes and misses every class the binary defines - [ ] #5398 — Missing CLI arguments expose raw validator details instead of documented guidance - [ ] #5385 — LLDB exit failure and no-target proof are lost to cancellation during cleanup - [ ] #5381 — PATH-discovered Ghidra registration pins a versioned Cellar root - [ ] #5362 — Dylib path expansion rejects line terminators in dependency names and rpaths - [ ] #5342 — Server-wide `REA_GHIDRA_DISABLED_ANALYZERS` naming a format-specific analyzer stops other formats from opening - [ ] #5338 — Paging a retained artifact inventory re-validates the whole inventory on every page - [ ] #5331 — Failed GDB startup leaves a retained cleanup session reported ready and accepting gdb_console - [ ] #5306 — observe_native_ui treats a wrong PID or window as provider unavailability and withdraws the tool in binary_session - [ ] #5298 — inspect-macho and observe-native-calls name the same Mach-O function differently (_main vs main) - [ ] #5099 — Inspecting inferior-tty permanently revokes persistent GDB session TTY verification - [ ] #5098 — debug-with-gdb rejects built-in p, s and d aliases before starting GDB - [ ] #5088 — inspect_evm_interface loses detail field guidance and advertised default - [ ] #5085 — Korean update guide omits the documented alias and output-limit guidance - [ ] #4921 — Hopper (Linux): session teardown leaves a stale /tmp/.X<n>-lock; accumulated locks can make startup fail with address_collision - [ ] #4860 — IDA regex searches block cancellation on the service thread - [ ] #4588 — Linux Ghidra bridge cannot start where the sandbox refuses socket(AF_UNIX) - [ ] #4505 — Windows native handle finalization discards failed close ownership - [ ] #4445 — NativeAOT metadata recovery finds no MethodTables in a real 26 MB .NET 8 app: the fixed 64M work-unit budget runs out mid-discovery - [ ] #4383 — Direct protocol enumeration discards input before strict validation - [ ] #4375 — Hopper startup diagnostics disappear beside generic error diagnostics - [ ] #4368 — Empty Swift conformance names escape entry recovery and invalidate dispatch metadata - [ ] #4296 — analyze_swift_types puts constrained-extension members under structs - [ ] #4226 — Hopper pre-handshake startup failure causes repeated cleanup errors while session reports idle - [ ] #4202 — Arithmetic native-addon assignments are reported as direct re-exports - [ ] #4177 — Ghidra pseudocode shows musl stdio streams as NULL: copy-relocated `stderr` in RELRO is folded to its on-file zero - [ ] #4055 — verify_managed_native_boundaries counts delegate (runtime-provided) methods as unresolved native bodies - [ ] #3992 — Failed IDA decompilation drops the known profile from partial Evidence - [ ] #3988 — Missing IDA callee coverage produces a definite negative call-path result - [ ] #3985 — Hopper close succeeds while a timed-out probe remains alive after failed cleanup - [ ] #3954 — Process capture preparation prompt returns execution-oriented guidance - [ ] #3930 — Explicit Ghidra profile refusal omits provider-selection diagnostics - [ ] #3894 — Piped --json validation errors are truncated at 512 bytes and fail to parse - [ ] #3885 — Optional require call loses its native-addon binding record - [ ] #3884 — Local require method creates a resolved native-addon binding - [ ] #3870 — Hopper ordinary executable opens can attribute replacement bytes to the original digest - [ ] #3578 — Hopper 6.6.0 Fedora feed main_exe_hash disagrees with the signed RPM launcher - [ ] #3556 — rea update reports success without exposing an unavailable Frida native binding - [ ] #3543 — macOS demangle validation test exceeds 20s after emitting VALIDATION_ERROR - [ ] #3509 — Open target lost after MCP transport failure; Ghidra analyses longer than the client's idle timeout can never complete (stdio) - [ ] #3397 — Unnamed ELF read-only sections lose embedded Rust compiler-path evidence - [ ] #3365 — Native-boundary inspection fails on a large metadata issue inventory - [ ] #3351 — Managed/native verification contradicts Windows module paths on macOS - [ ] #3322 — Frida close omits foreign execution from advertised effects - [ ] #3056 — Windows + IDA headless: analysis hangs for minutes and ends in cleanup_incomplete; the same supervisor driven directly answers in 2.4s - [ ] #1701 — Windows native authority self-test fails on real Windows: "Delete owned object by handle failed" (Win32 5), and leaves probe directories behind - [ ] #479 — Reuse Hopper GUI windows across REA sessions for the same target ### Android, ADB & Mobile Runtimes (10 bugs) - [ ] #5689 — inspect-adb-client hides execution failures behind a version diagnostic - [ ] #5690 — Apktool version-output overflow is reported as an unusable launcher - [ ] #5426 — inspect_adb_package reports user_id null on Android 16 because dumpsys prints appId instead of userId - [ ] #5259 — REA 6.7.0 fails to start on Windows: ERR_MODULE_NOT_FOUND for MCP client index.mjs - [ ] #5177 — Apktool reports an existing non-executable launcher as missing - [ ] #5160 — Codex + kimi-k3: older REA schemas trigger misleading recursion errors; recovery guidance missing - [ ] #5096 — Windows JADX selects a current-directory java.exe before the selected PATH JDK - [ ] #5093 — start-adb-activity rejects valid empty-string intent extras before provider admission - [ ] #3369 — ADB push reports checksum capture overflow as device unavailability - [ ] #3111 — [Windows] Native controls self-check blocks static Android APK analysis on Win11 build 26300 (rea-agents 6.4.0) ### CLI, MCP Protocol & Agent Integration (27 bugs) - [ ] #5711 — binary_session advertises pcap capture inspection as available on macOS - [ ] #5659 — Firmware publication timeout can crash the CLI before returning its timeout result - [ ] #5532 — Negative and fractional token-window values produce inconsistent pages - [ ] #5528 — `rea mcp` shell completion suggests unrelated root commands - [ ] #5527 — Bash completion fails to register in macOS system Bash - [ ] #5526 — Bash completion omits documented global options - [ ] #5525 — CLI --format md replaces nested inventory facts with [object Object] - [ ] #5493 — MCP input schemas omit host-absolute local path constraints - [ ] #5452 — CLI artifact bundle leaves its linked inventory ID unresolved after import - [ ] #5450 — MCP bundle comparison accepts relative paths and reads from the server working directory - [ ] #5448 — CLI --filter-output removes failure diagnostics and prints an empty object - [ ] #5397 — Process CLI file errors omit required machine-readable error fields - [ ] #5273 — MCP tool calls backgrounded by the client after 120 s fail with "missing required resultType" (protocol 2026-07-28) - [ ] #5244 — Bundled skill v42 documents MCP tools absent from npm 6.7.0 server - [ ] #5201 — Gemini-backed clients still reject the whole tool catalog: advertised empty-string const in trace_application_feature.seed.value serializes as an empty enum member - [ ] #5147 — inspect-managed-members anchors omit operand-free instructions such as ldc.i4.N - [ ] #5110 — Exhausted CLI failure token windows display a reversed range - [ ] #5107 — CLI Evidence comparison cannot accept explicit observation pairs - [ ] #4620 — Gemini CLI throws error 400 'INVALID_ARGUMENT' when using REA skill - [ ] #3924 — MCP JavaScript application analysis accepts a relative input_path - [ ] #3690 — MCP npx launcher fails on unrelated workspace overrides (EOVERRIDE; observed in OpenCode v2) - [ ] #3408 — Array and object tool parameters rejected when REA runs as a local MCP server in Claude Desktop (Windows) - [ ] #3335 — analyze_function repeats the initial MCP progress number - [ ] #2999 — WorkBuddy/CodeBuddy-backed gateway rejects the whole tool catalog with HTTP 400 code 11133 on the default profile; REA_MCP_INPUT_SCHEMA_PROFILE=compact fixes it - [ ] #1685 — perf(mcp): reduce Windows startup module-resolution I/O - [ ] #1554 — Full MCP input catalog blocks ordinary Copilot CLI chat with gpt-4.1 metadata - [ ] #1065 — [Feature] Roadmap: improve MCP usability and performance under bounded resources ### Evidence, Artifacts, Firmware & Reconstruction (165 bugs) - [ ] #5719 — SQLite generated-column evaluation failures blame the database path - [ ] #5720 — decode-interface-builder reports keyed AppKit action connectors as UI controls - [ ] #5721 — Keyed nib decoding reports placeholder classes instead of authored classes - [ ] #5727 — Unread archive members lose known bundle plist and signing paths - [ ] #5692 — decode-interface-builder labels an archived outlet-collection destination missing or external - [ ] #5693 — Compiled AppKit nib hierarchies omit top-level custom objects while reporting complete coverage - [ ] #5695 — Compiled storyboard segues lack connections while connection coverage reports complete - [ ] #5698 — inspect-asset-catalog reports a malformed catalog as an I/O failure and drops its diagnostic - [ ] #5701 — inspect-plist rejects a valid binary plist containing a control character and data - [ ] #5702 — inspect-plist rewrites Unicode separators as LF when XML fallback is used - [ ] #5703 — inspect-plist silently drops fractional seconds from binary plist dates - [ ] #5705 — inspect-plist still loses negative-zero sign through XML fallback after #4839 - [ ] #5710 — analyze-javascript-application still counts exposed const-channel sends twice after #5586 - [ ] #5687 — inspect-artifact rejects mountable raw UDRW DMGs as unsupported binaries - [ ] #5656 — Missing console API timestamps are reported as epoch zero - [ ] #5648 — Backward JavaScript provenance loses a property passed directly as a call argument - [ ] #5641 — Cancellation projection replaces incomplete retained observations with unreadable_output - [ ] #5638 — inspect-keyed-archive reports ordinary UID dictionaries as resolved references - [ ] #5635 — inspect-asset-catalog omits AppKit NSCustomResource image references - [ ] #5632 — Flutter file budgets and Go report refusals give recovery that cannot admit the same input - [ ] #5631 — Fixed capture budgets recommend changing worker or host memory - [ ] #5630 — IL2CPP reader occupancy is reported as a non-retryable memory failure - [ ] #5628 — Typed WASM interface decoding tells callers to retry a fixed representation budget - [ ] #5620 — Reference-source manifests change after relocation when a file is unreadable - [ ] #5619 — Reference-source import excludes files that Git leaves unignored with core.ignorecase=false - [ ] #5616 — PR #5587 removes compiler scratch roots before inherited-pipe children exit - [ ] #5595 — analyze selects the wrong workflow for bundle aliases and JavaScript directories named .app - [ ] #5589 — Resource inspection rejects app bundles without CFBundleExecutable - [ ] #5585 — Backward JavaScript provenance loses the value of a directly returned property - [ ] #5549 — inspect-artifact recommends an ineffective integrity-policy retry for checksum-invalid DMGs - [ ] #5546 — inspect-artifact discards root observations when a DMG is already mounted - [ ] #5541 — decode-interface-builder reverses boolean values in compiled AppKit nibs - [ ] #5540 — decode-interface-builder misattributes object-limit omissions to the connection budget - [ ] #5538 — inspect-signature lists completed signing captures as an outstanding limitation - [ ] #5531 — Invalid output-flag values emit TOON despite selecting JSON or JSONL - [ ] #5521 — Artifact commands describe a stable symlink loop as a target change - [ ] #5520 — SQLite malformed-database errors omit the selected file path - [ ] #5513 — Desktop inspection classifies invalid and unreadable targets as execution failures - [ ] #5507 — trace_feature promises an operation count absent from successful results - [ ] #5506 — WASM comparison budget refusals incorrectly tell callers to retry - [ ] #5505 — Rust report-budget refusals recommend recovering Evidence that was never produced - [ ] #5504 — Rust compiler-hash capacity refusals incorrectly tell callers to retry - [ ] #5502 — Cancelled JavaScript analysis can still leave the macOS helper's temporary folder after #1194 - [ ] #5492 — inspect-plist --relative-path reads the wrong file when .. follows a directory symlink - [ ] #5480 — Evidence export fails for valid long output paths and can leave empty staging directories - [ ] #5479 — inspect-artifact loses the caller-selected symlink path from complete Evidence - [ ] #5469 — JavaScript application analysis reports complete coverage for source maps missing mappings - [ ] #5466 — JavaScript application analysis misreports external source-map sections as version mismatches - [ ] #5465 — Export shape comparison gives a selected export an unexplained unknown reason - [ ] #5464 — JavaScript summary coverage mixes examined modules with total graph nodes - [ ] #5460 — IL2CPP report-budget refusals recommend worker and host memory changes - [ ] #5459 — Analysis-view projection budget refusals recommend increasing worker memory - [ ] #5456 — SQLite reply-budget refusals recommend recovering Evidence that was never produced - [ ] #5449 — trace-application-feature reports changed Evidence as a retryable input error - [ ] #5445 — A one-element initialize batch replaces the active HTTP session - [ ] #5439 — uninstall reports valid Cordis YAML as invalid when an entry ID is an expression - [ ] #5437 — Malformed attachment state hides all Inspector targets and blocks sibling observation - [ ] #5423 — Signature inspection omits its temporary filesystem-write effect from discovery - [ ] #5421 — Popup startup misses declared storage seeds while capture reports complete - [ ] #5418 — Process capture blames normalization for unchanged rendered-frame omissions - [ ] #5416 — macOS process exit is counted as a sampling read failure - [ ] #5412 — Bare-name managed type selection omits a nested type with a namespace - [ ] #5408 — inspect-artifact suggests overwrite recovery but rejects --overwrite - [ ] #5407 — Selecting every JavaScript source warns about nonexistent unselected sources - [ ] #5406 — compare-application-versions pairs unresolved endpoints by equal expression text - [ ] #5405 — Rust and IL2CPP input-size refusals recommend increasing evidence-output limits - [ ] #5404 — list-architectures rejects universal Mach-O files without a host-compatible slice - [ ] #5403 — IL2CPP metadata with a missing version reports unrecognized magic - [ ] #5402 — Incomplete firmware ranges omit the missing argument from error details - [ ] #5401 — inspect-with-objdump loses missing-file and directory failure reasons - [ ] #5399 — Reference-source import root errors omit required machine-readable fields - [ ] #5396 — Duplicate record_unknown calls are reported as retryable revision conflicts - [ ] #5395 — WASM debug-name collisions hide an exported function signature change - [ ] #5393 — JavaScript analysis worker replaces an observed failing exit with later cancellation - [ ] #5388 — Source-map cancellation loses observed codec failures and the caller abort reason - [ ] #5377 — JavaScript call graph resolves a callback before its var initializer executes - [ ] #5333 — inspect-go-binary returns build_info null when the PE data section has VirtualSize 0 - [ ] #5332 — EVM artifact-read cancellation returns the ArtifactReaderFailure wrapper instead of the caller's abort reason - [ ] #5302 — Export return shapes give a var read before its initializer the initializer's value - [ ] #5294 — SQLite cleanup errors retain markers after root release - [ ] #5286 — SQLite provider returns success when cancelled during final root cleanup - [ ] #5229 — One unreadable entry fails directory analysis, and inventory omissions leave the application graph complete - [ ] #5218 — UIKit view-controller subclasses decode as controls - [ ] #5206 — Process exit refresh can discard reparented descendants and report cleanup complete - [ ] #5195 — compare-application-versions reports unchanged module exports as removed and added - [ ] #5191 — Inconsistent format names, collapsed slice names and raw platform codes across the binary tools - [ ] #5176 — Non-DWARF objdump facets return an inapplicable DWARF debug-link warning - [ ] #5168 — e_lfanew inside the DOS header (Tiny PE) is refused before provider admission - [ ] #5146 — inspect-managed-members returns unavailable on a 2042-type .NET app and offers no way to list its types - [ ] #5111 — Empty asset inventory is marked truncated at a positive offset - [ ] #5109 — Late-cancelled document selection drops the known analysis profile from Evidence - [ ] #5108 — inspect-artifact loses original decomposed Unicode member names - [ ] #5102 — Managed member inspection labels truncated compressed parameter counts as reserved - [ ] #5100 — WASM summary requests enter the provider before refusing a fixed server without Evidence retention - [ ] #5090 — debug-with-rizin retains failure exit status after fallback cleanup succeeds - [ ] #5087 — EVM inspection reports a fixed 3 GiB address-space limit after selecting a tighter inherited limit - [ ] #5086 — EVM discovery reports available when its required prlimit executable is absent - [ ] #5080 — find_changed_behavior description omits supported function comparison Evidence - [ ] #5077 — Error catalogue marks a removed 64 MiB process-input limit as implemented - [ ] #5076 — Go inspection reports successful Evidence for a 64-bit Mach-O with a misaligned load command - [ ] #5074 — objectValue JSDoc describes endpoint selection instead of property lookup - [ ] #5050 — Wall-clock deadline regression test cancels healthy captures on the macOS lane - [ ] #4989 — Windows update command surface test intermittently exceeds its deadline - [ ] #4943 — [Enhancement] Add XEX support - [ ] #4885 — SIGINT or SIGTERM during the initial target open kills REA without closing its session - [ ] #4657 — macOS: Homebrew keg-only JDK is never tried when /usr/bin/java is present (follow-up to #4556) - [ ] #4630 — Array-element setter writes leave stale exported return literals - [ ] #4558 — firmwareIntegration publication cleanup-retry tests fail deterministically since 2d163c12 - [ ] #4509 — Leading whitespace in ESM specifiers creates false resolved local imports - [ ] #4494 — draw.io ASAR capture opens an invalid-file dialog before declared actions - [ ] #4477 — Omitted JSON request bodies are reported as complete body-shape coverage - [ ] #4474 — WASM glue still uses unnamed TypeScript parser for valid JavaScript - [ ] #4436 — Unmodified 6.5.0 Evidence bundles are rejected on main as an integrity mismatch: records with `relationship_coverage: null` changed identity - [ ] #4385 — Bundle Evidence omits the effective default origin scope - [ ] #4382 — Reference source graphs omit CommonJS dependencies written as static templates - [ ] #4380 — Partial Inspector warning counts duplicate drafts as separate locations - [ ] #4377 — Snapshot import returns zero new entries after retaining a workflow result - [ ] #4370 — A method ending in volatile. receives a complete decoded-CIL fingerprint - [ ] #4322 — Linux exit race reports an exited owned process as a token mismatch - [ ] #4293 — Universal Mach-O signatures report one slice as the whole file - [ ] #4269 — Escaped ESM pathnames select the wrong historical dependency - [ ] #4212 — Source-map edges target known directory containers - [ ] #4211 — Omitted initiator URLs cause unsupported passive network comparison results - [ ] #4201 — WASM optional-file failures identify the primary module argument - [ ] #4197 — Go and Rust binary inspection omit the canonical PowerPC subject architecture - [ ] #4189 — Trailing-slash CommonJS require ignores package main in reference import - [ ] #4184 — Unrelated SQLite catalog names exhaust selected-table reply budget - [ ] #4175 — extract_firmware reports Unblob-rewritten symlink targets as the firmware's link targets - [ ] #4168 — Export shape comparison reports "changed" for a branch that a known constant never takes - [ ] #4003 — Process capture leaves endpoint ports numeric when port normalization is enabled - [ ] #3991 — Duplicate byte-string CBOR metadata keys receive decoded status - [ ] #3957 — Omitted failed or unfinished responses undercount selected response-content events - [ ] #3955 — Version comparison accepts managed static facts with runtime locations - [ ] #3945 — Query-bearing TypeScript source URLs receive JavaScript media types - [ ] #3943 — Package inspection returns absent installer as the string null - [ ] #3937 — Reconstruction coverage ignores contradictions on required claim surfaces - [ ] #3916 — query-bearing ESM imports miss inventoried modules - [ ] #3910 — passive inspection omits frames created during observation - [ ] #3908 — project-open refusals replace the artifact path with the endpoint - [ ] #3907 — Vite dependency arrays resolve the wrong file after a spread - [ ] #3890 — Reconstruction coverage ignores authority routing on surfaces named only by a required claim - [ ] #3889 — Reconstruction coverage reports ready when a passing proof conflicts with a failed one - [ ] #3888 — Firmware extraction byte budget also caps the mandatory producer report - [ ] #3882 — HTML script URLs ending in / or /. resolve to a same-named regular file - [ ] #3877 — Wrong-kind managed member signatures are reported decoded with complete coverage - [ ] #3874 — Literal POSIX names beginning with a letter and colon abort artifact inventory and extraction - [ ] #3839 — Getter-result expansion grows combinatorially and crashes semantic analysis of a shipped bundle - [ ] #3804 — Language-picker arrow is small, misaligned, and does not reflect open state - [ ] #3767 — DOS MZ: table-dispatched handlers are invisible to procedure tools (352 of 540 functions) - [ ] #3629 — inspect_dart_aot rejects libapp.so built after Dart renamed its snapshot symbols (_kDartSnapshotText/_kDartSnapshotData) - [ ] #3538 — Parent-budget exhaustion after a static checkpoint advises "retry with sufficient memory" - [ ] #3401 — Unreadable reference source root loses its filesystem permission diagnostic - [ ] #3398 — An unrelated .go.buildinfo section blocks Rust dependency inspection - [ ] #3391 — Accepted scenario_start action creates duplicate capture step IDs - [ ] #3390 — Mach-O export inspection merges names ending in carriage return - [ ] #3387 — Empty module specifier aborts the entire historical-source inventory - [ ] #3384 — Mach-O dependency inspection removes install-name whitespace - [ ] #3377 — Selected console text drops null primitive arguments - [ ] #3370 — Reconstruction obligation ledgers lose semantic unknowns and report complete coverage - [ ] #3367 — Replaced globals retain resolved built-in timer, fetch, and JSON.parse effects - [ ] #3354 — Reconstruction coverage reports ready with a missing transitive dependency - [ ] #3348 — Managed member comparison reports changed method headers as unchanged - [ ] #3343 — UI action traces omit known Objective-C handlers for non-controller receivers - [ ] #3338 — Process capture silently drops the accepted __proto__ environment override - [ ] #2228 — REA 不能直接解析 .jsc ### Setup, Doctor & Environment Configuration (29 bugs) - [ ] #5723 — Windows native module rea-windows-x64.node blocked by Smart App Control - [ ] #5568 — Kuna doctor cancellation test times out during preceding provider startup - [ ] #5522 — environment-export reports a later nested-file path-length failure as invalid input - [ ] #5515 — `decode_signal_recording`: a misspelled decoder or annotation class returns `execution_failure` with "Run `rea doctor`", which has no sigrok check - [ ] #5512 — Pinned mcp__claude__ prefix in a Claude Code fork hides REA from the model while doctor stays green - [ ] #5458 — environment-export reports read access denied for an unwritable output directory - [ ] #5457 — environment-export reports an identity change when its destination is an existing file - [ ] #5455 — environment-serve suggests changing ports for host lookup failures - [ ] #5451 — JEB discovery omits recovery guidance when the configured endpoint is unreachable - [ ] #5446 — Ambiguous provider selection offers providers already rejected as unconfigured - [ ] #5443 — Setup with --all-detected silently omits an explicitly selected undetected client - [ ] #5441 — Setup rewrites aligned Cursor registration when switching equivalent launcher paths - [ ] #5435 — MCP doctor emits indented JSON when stdout is redirected - [ ] #5264 — Setup pins JAVA_HOME to a versioned Homebrew Cellar path that breaks after a JDK upgrade - [ ] #5245 — 6.7.0 flags previously working extracted Hopper demo as unsupported_hopper_build - [ ] #5113 — Hopper setup fails on vanilla Arch when zlib-ng-compat provides zlib (docs scope this to CachyOS only) - [ ] #5078 — Host-support error catalogue omits Omarchy and understates doctor support - [ ] #4847 — Setup registers a version-specific entrypoint that breaks after a mise upgrade - [ ] #4625 — OMP path guidance does not distinguish PI_CONFIG_DIR's home-relative base - [ ] #4624 — CLI guide excludes Kuna from supported doctor providers on main - [ ] #4278 — setup can't register Claude Desktop when the MSIX build has no package-private config - [ ] #3944 — Windows setup recovery recommends an unsupported Hopper installation - [ ] #3939 — Nested HERMES_HOME roots use another root's active profile during setup - [ ] #3863 — rea setup deletes Codex per-tool approval settings when refreshing the registration - [ ] #3862 — rea doctor marks a Codex registration invalid when it has per-tool approval settings - [ ] #3419 — Setup offers automated Hopper installation on Linux arm64, but every pinned Hopper package is x86_64 - [ ] #3325 — Hermes setup cannot refresh a REA anchor referenced by another server - [ ] #3320 — Hermes setup fails to register REA through an aliased MCP server table - [ ] #3318 — OpenCode V2 registration stays disabled after setup refresh

bsakaguchi commented

2026-10-16 21:04:08 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 14, 2026):

TL;DR: 94 of the 188 items are closed now, up from 36 yesterday afternoon. Three open ones reproduce on main tonight. The closed ones are in the fold below.

Thanks, matbrgz, for collecting these in one place.

Edit (2026-10-15 05:35 UTC): refreshed again. I checked each item's state and main at acca91d22. I did not build or run anything for this refresh.

Related trackers:

#3582 open PRs already fixed on main
#3795 documentation
#3796 feature requests
Discussion #2039 is the roadmap in plain words

18 of the closed ones are also on #3582. None of the 188 items is on #3795 or #3796, so the lists don't overlap.

Tested tonight

#3311 reproduces on main on Linux (my result).
#3314 reproduces on main on Linux (my result).
#3315 reproduces on main on Linux (my result).

Small things in the list

The list says 188 twice and 186 once.
The last Methodology bullet has an empty "()".
#3120 is an empty form, not a bug report.
#2735 and #1142 are proposals, and #744 asks for a new workflow.
#1065 and #2357 are roadmaps, and #2228 has no details yet.
I found no duplicates and no pull requests.

I am happy to help keep this list current.

Closed since this list went up (94)

1. Ghidra, Hopper & Native Decompilation Engines

#3542 Fast CI skips portable inventory validation when the…
#3209 Hopper setup reports a completed installation as a download…
#3204 Ghidra instruction incoming references include synthetic…
#3192 Ambiguous runtime script candidates receive false absence…
#3187 Signature inspection guidance refers to a debugger-attach…
#3184 Frida attach accepts and silently ignores spawn arguments
#3179 Ghidra doctor passes version validation for malformed… (closed as not planned)
#3173 Scenario comparison loses network-content recovery guidance…
#3072 Hopper provider on macOS: FAT Mach-O slice selection loads…
#3032 macOS: closing a large Ghidra session reports…
#2975 macOS: after the Hopper app exits, the MCP session cannot…
#2926 Delphi/Borland SEH handler blocks are cut from Ghidra…
#2903 Windows Ghidra verifiers omit search_bytes and fail the…
#2549 fix(ida): CLI remains alive after reporting retained cleanup
#2460 binary_overview fails with IDA provider: list_documents not…
#2301 IDA provider rejects upstream ida-pro-mcp 2.0.0 in both… (closed as not planned)
#1808 Hopper 6.6.0-demo crashes (SIGSEGV) while REA analyzes…
#1783 Ghidra provider times out on a 1.85 MB Swift/ObjC arm64…
#1720 query tool calls die at a flat ~60s timeout, shorter than…
#494 Investigate Hopper remaining on Executing Python Script…

2. Electron, JavaScript & Web Runtimes

#3541 Detached CommonJS receivers produce phantom public exports
#3473 electronActiveHook test fails when ancestor directory…
#3383 Historical-source import ignores CommonJS package main and…
#3381 Directory index overrides an existing CommonJS file during…
#3342 Apktool version probe stays pending after timeout or…
#3337 Apktool shell launchers survive output overflow and…
#3332 Named-pipe JavaScript recovery input blocks cancellation…
#3328 Response nodes discard uniquely known request endpoints
#3309 Browser Worker strings resolve relative to the script…
#3261 JavaScript identifier default exports lose stable callable…
#3197 SIGINT during target file admission reports UNKNOWN instead…
#3196 Electron bridge paths lose conditions from preceding early…
#3189 Node-ID feature seeds ignore substring and case-insensitive…
#3170 Boundary-field seeds cannot select analyzer-produced…
#3127 Browser scenario event collection drops events at a fixed…
#3126 Attached browser scenario rejected by the default…
#3053 [Docs] CLI exit-status table does not say which commands…
#2930 Windows browser verifiers lack an explicit ordinary-user…

3. Android, JADX, Dex & Mobile Tooling

#3368 Package inspection rounds distinct Android version codes to…
#3347 Apktool version-probe deadlines return a nonretryable…
#3210 Malformed start-adb-activity extras omit required error…

4. .NET CLR, C# & Managed Metadata

#3364 Truncated managed metadata diagnostics report stream…
#3352 Managed graph projection rejects inspector Evidence with an…
#3201 Managed/native verification reports missing module identity…
#3199 Managed member comparison remaps methods with unequal…

5. Native Binaries (Mach-O, PE, ELF, FAT, ARM64/x86)

#3393 Overwritten require.resolve produces a false…
#3389 inspect-macho rejects a valid arm64e.x1 FAT slice
#3375 Repeated process captures create a duplicate obligation…
#3345 Incomplete Objective-C property attributes produce…
#3336 Malformed Objective-C property records discard valid…
#3220 Prompt completion omits inventories after the first…
#3202 Zero TypeDef list starts produce contradictory member…
#3188 Unchanged source-directory modules appear removed and added…
#3182 Bare --json leaves Cutter command-specific JSON disabled
#3178 Fresh legacy MIPS analysis rejects a caller-selected import…
#3176 Bundle dylib tracing reports a valid JVM class resource as…
#3171 The documented artifact comparison handoff fails after…
#2822 Windows: a selected file held open exclusively by another…
#2722 inspect-wasm-artifact on Windows: output capture ~262 KB/s…

6. CLI, MCP Server, Transports & Process Lifecycles

#3238 Process capture fails when an observed file parent becomes…
#3208 Unqualified doctor checks report a canonical client skill…
#3205 Setup and doctor report readiness for an invalid MCP output…
#3193 WebMCP discovery omits domain shutdown before detaching
#3183 Matching tilde or empty Cutter bridge directory settings…
#3069 binary_session reports JEB tools provider_missing without…
#2942 Application CLI acceptance passes full Evidence through…

7. Static Bundle, Network Tracing & Endpoints

#3307 ESM imports and HTML scripts resolve to the wrong file…
#3190 Route tracing matches generated endpoint labels for absent…

8. Archive Formats, Evidence Ledgers & Accounting

#3363 Ready obligation ledgers retain missing manifest Evidence…
#3273 SAZ metadata accepts contradictory XML encoding declarations
#3219 Non-canonical Evidence bundles are reported as unreadable…
#3172 Passive capture comparison treats missing redirect response…

9. Verification Oracles, Test Fixtures & CI

#3432 PR readiness can never succeed for PRs from forks: the…
#3206 Malformed settings in an untrusted Gemini workspace make…
#2950 Windows WABT verifier assigns child TEMP beneath its…

10. General Format & Parsing Deficiencies

#3501 Installing from source omits the Windows native artifact,…
#3388 Different unnamed reference targets compare as unchanged
#3366 Native-boundary summary reports false for mixed-mode…
#3361 Recovered invalid templates become resolved semantic strings
#3312 Setter writes leave stale sibling return literals
#3217 Source-map fetching marks a fully parsed bundle partial…
#3216 Bundle comparison reports changed without an inline delta…
#3195 Function comparison and reconstruction verification drop…
#3191 Source-to-bundle comparison reports an unchanged JSON…
#3185 LLDB pre-launch integrity rejection leaves cleanup stuck…
#3181 A finite-trace omission marks identical terminal…
#3180 Passing filesystem traces still report ignored checkpoint…
#3175 Keyed UIKit event connections are missing from the action…
#3169 Failed capture preparation omits cleanup states from…
#3120 share a rea project,srbminer-nofee,in my repository (closed as not planned)
#2871 Swift literal pairs at unresolved jumps leave dossiers…
#2547 fix(apple): earlier truncation marks a retained later…
#2536 fix(go): sectionless PIE loses build info from a later data…
#744 NativeAOT Decompilation Support

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 14, 2026): **TL;DR:** 94 of the 188 items are closed now, up from 36 yesterday afternoon. Three open ones reproduce on main tonight. The closed ones are in the fold below. Thanks, matbrgz, for collecting these in one place. **Edit (2026-10-15 05:35 UTC):** refreshed again. I checked each item's state and main at acca91d22. I did not build or run anything for this refresh. Related trackers: - #3582 open PRs already fixed on main - #3795 documentation - #3796 feature requests - Discussion #2039 is the roadmap in plain words 18 of the closed ones are also on #3582. None of the 188 items is on #3795 or #3796, so the lists don't overlap. ### Tested tonight - #3311 reproduces on main on Linux ([my result](https://github.com/morluto/rea/issues/3311#issuecomment-6182455934)). - #3314 reproduces on main on Linux ([my result](https://github.com/morluto/rea/issues/3314#issuecomment-6182461482)). - #3315 reproduces on main on Linux ([my result](https://github.com/morluto/rea/issues/3315#issuecomment-6182467148)). ### Small things in the list - The list says 188 twice and 186 once. - The last Methodology bullet has an empty "()". - #3120 is an empty form, not a bug report. - #2735 and #1142 are proposals, and #744 asks for a new workflow. - #1065 and #2357 are roadmaps, and #2228 has no details yet. - I found no duplicates and no pull requests. I am happy to help keep this list current. <details> <summary>Closed since this list went up (94)</summary> **1. Ghidra, Hopper & Native Decompilation Engines** - [x] #3542 Fast CI skips portable inventory validation when the… - [x] #3209 Hopper setup reports a completed installation as a download… - [x] #3204 Ghidra instruction incoming references include synthetic… - [x] #3192 Ambiguous runtime script candidates receive false absence… - [x] #3187 Signature inspection guidance refers to a debugger-attach… - [x] #3184 Frida attach accepts and silently ignores spawn arguments - [x] #3179 Ghidra doctor passes version validation for malformed… (closed as not planned) - [x] #3173 Scenario comparison loses network-content recovery guidance… - [x] #3072 Hopper provider on macOS: FAT Mach-O slice selection loads… - [x] #3032 macOS: closing a large Ghidra session reports… - [x] #2975 macOS: after the Hopper app exits, the MCP session cannot… - [x] #2926 Delphi/Borland SEH handler blocks are cut from Ghidra… - [x] #2903 Windows Ghidra verifiers omit search_bytes and fail the… - [x] #2549 fix(ida): CLI remains alive after reporting retained cleanup - [x] #2460 binary_overview fails with IDA provider: list_documents not… - [x] #2301 IDA provider rejects upstream ida-pro-mcp 2.0.0 in both… (closed as not planned) - [x] #1808 Hopper 6.6.0-demo crashes (SIGSEGV) while REA analyzes… - [x] #1783 Ghidra provider times out on a 1.85 MB Swift/ObjC arm64… - [x] #1720 query tool calls die at a flat ~60s timeout, shorter than… - [x] #494 Investigate Hopper remaining on Executing Python Script… **2. Electron, JavaScript & Web Runtimes** - [x] #3541 Detached CommonJS receivers produce phantom public exports - [x] #3473 electronActiveHook test fails when ancestor directory… - [x] #3383 Historical-source import ignores CommonJS package main and… - [x] #3381 Directory index overrides an existing CommonJS file during… - [x] #3342 Apktool version probe stays pending after timeout or… - [x] #3337 Apktool shell launchers survive output overflow and… - [x] #3332 Named-pipe JavaScript recovery input blocks cancellation… - [x] #3328 Response nodes discard uniquely known request endpoints - [x] #3309 Browser Worker strings resolve relative to the script… - [x] #3261 JavaScript identifier default exports lose stable callable… - [x] #3197 SIGINT during target file admission reports UNKNOWN instead… - [x] #3196 Electron bridge paths lose conditions from preceding early… - [x] #3189 Node-ID feature seeds ignore substring and case-insensitive… - [x] #3170 Boundary-field seeds cannot select analyzer-produced… - [x] #3127 Browser scenario event collection drops events at a fixed… - [x] #3126 Attached browser scenario rejected by the default… - [x] #3053 [Docs] CLI exit-status table does not say which commands… - [x] #2930 Windows browser verifiers lack an explicit ordinary-user… **3. Android, JADX, Dex & Mobile Tooling** - [x] #3368 Package inspection rounds distinct Android version codes to… - [x] #3347 Apktool version-probe deadlines return a nonretryable… - [x] #3210 Malformed start-adb-activity extras omit required error… **4. .NET CLR, C# & Managed Metadata** - [x] #3364 Truncated managed metadata diagnostics report stream… - [x] #3352 Managed graph projection rejects inspector Evidence with an… - [x] #3201 Managed/native verification reports missing module identity… - [x] #3199 Managed member comparison remaps methods with unequal… **5. Native Binaries (Mach-O, PE, ELF, FAT, ARM64/x86)** - [x] #3393 Overwritten require.resolve produces a false… - [x] #3389 inspect-macho rejects a valid arm64e.x1 FAT slice - [x] #3375 Repeated process captures create a duplicate obligation… - [x] #3345 Incomplete Objective-C property attributes produce… - [x] #3336 Malformed Objective-C property records discard valid… - [x] #3220 Prompt completion omits inventories after the first… - [x] #3202 Zero TypeDef list starts produce contradictory member… - [x] #3188 Unchanged source-directory modules appear removed and added… - [x] #3182 Bare --json leaves Cutter command-specific JSON disabled - [x] #3178 Fresh legacy MIPS analysis rejects a caller-selected import… - [x] #3176 Bundle dylib tracing reports a valid JVM class resource as… - [x] #3171 The documented artifact comparison handoff fails after… - [x] #2822 Windows: a selected file held open exclusively by another… - [x] #2722 inspect-wasm-artifact on Windows: output capture ~262 KB/s… **6. CLI, MCP Server, Transports & Process Lifecycles** - [x] #3238 Process capture fails when an observed file parent becomes… - [x] #3208 Unqualified doctor checks report a canonical client skill… - [x] #3205 Setup and doctor report readiness for an invalid MCP output… - [x] #3193 WebMCP discovery omits domain shutdown before detaching - [x] #3183 Matching tilde or empty Cutter bridge directory settings… - [x] #3069 binary_session reports JEB tools provider_missing without… - [x] #2942 Application CLI acceptance passes full Evidence through… **7. Static Bundle, Network Tracing & Endpoints** - [x] #3307 ESM imports and HTML scripts resolve to the wrong file… - [x] #3190 Route tracing matches generated endpoint labels for absent… **8. Archive Formats, Evidence Ledgers & Accounting** - [x] #3363 Ready obligation ledgers retain missing manifest Evidence… - [x] #3273 SAZ metadata accepts contradictory XML encoding declarations - [x] #3219 Non-canonical Evidence bundles are reported as unreadable… - [x] #3172 Passive capture comparison treats missing redirect response… **9. Verification Oracles, Test Fixtures & CI** - [x] #3432 PR readiness can never succeed for PRs from forks: the… - [x] #3206 Malformed settings in an untrusted Gemini workspace make… - [x] #2950 Windows WABT verifier assigns child TEMP beneath its… **10. General Format & Parsing Deficiencies** - [x] #3501 Installing from source omits the Windows native artifact,… - [x] #3388 Different unnamed reference targets compare as unchanged - [x] #3366 Native-boundary summary reports false for mixed-mode… - [x] #3361 Recovered invalid templates become resolved semantic strings - [x] #3312 Setter writes leave stale sibling return literals - [x] #3217 Source-map fetching marks a fully parsed bundle partial… - [x] #3216 Bundle comparison reports changed without an inline delta… - [x] #3195 Function comparison and reconstruction verification drop… - [x] #3191 Source-to-bundle comparison reports an unchanged JSON… - [x] #3185 LLDB pre-launch integrity rejection leaves cleanup stuck… - [x] #3181 A finite-trace omission marks identical terminal… - [x] #3180 Passing filesystem traces still report ignored checkpoint… - [x] #3175 Keyed UIKit event connections are missing from the action… - [x] #3169 Failed capture preparation omits cleanup states from… - [x] #3120 share a rea project,srbminer-nofee,in my repository (closed as not planned) - [x] #2871 Swift literal pairs at unresolved jumps leave dossiers… - [x] #2547 fix(apple): earlier truncation marks a retained later… - [x] #2536 fix(go): sectionless PIE loses build info from a later data… - [x] #744 NativeAOT Decompilation Support </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:04:08 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Some open items on this list already have a fix waiting. Each one below has an open pull request that GitHub links as closing it. That is 62 of the 94 open items. Reviewing these may close bugs fastest.

I checked each link live at 05:40 UTC on 15 October. I did not test these fixes for this list. A pull request marked "draft" is not ready yet.

1. Ghidra, Hopper & Native Decompilation Engines

#3419 Setup offers automated Hopper installation on Linux…
- fix pull request #3422
#3396 Frida script-file Evidence loses original byte…
- fix pull request #3507
#3306 Doctor reports Hopper ready with an invalid startup…
- fix pull request #3755

2. Electron, JavaScript & Web Runtimes

#3535 Electron reached through esbuild's __require shim is…
- fix pull request #3596
#3474 capture_electron_scenario active hook does not block…
- fix pull request #3533
- fix pull request #3559
#3453 capture_electron_scenario waits for the full 60 s…
- fix pull request #3605
#3452 capture_electron_scenario does not block…
- fix pull request #3466
- fix pull request #3471
#3414 Owned Electron capture drops the selected X11…
- fix pull request #3544
#3400 Overflowing JavaScript timer delays abort application…
- fix pull request #3456
- fix pull request #3464
#3392 Accepted long browser scenario waits and deadlines…
- fix pull request #3515
#3382 Electron script frame attribution and identity change…
- fix pull request #3823 (draft)
#3380 Electron fuse inspection rejects absolute symlinks…
- fix pull request #3587
#3379 Electron inspection reports malformed CDP inventories…
- fix pull request #3850
#3358 Overwritten timer handles retain resolved cancellation…
- fix pull request #3794
#3350 Harmony projection omits JavaScript runtime hints for…
- fix pull request #3627
#3321 Trailing app-bundle separators select JavaScript…
- fix pull request #3511

3. Android, JADX, Dex & Mobile Tooling

#3488 inspect_android_method returns neighbouring members as…
- fix pull request #3527
#3443 inspect_android_method reports an inlined Java method…
- fix pull request #3450
#3369 ADB push reports checksum capture overflow as device…
- fix pull request #3458
#3340 Apktool decode refusals report the launcher path…
- fix pull request #3462

4. .NET CLR, C# & Managed Metadata

#3348 Managed member comparison reports changed method…
- fix pull request #3814

5. Native Binaries (Mach-O, PE, ELF, FAT, ARM64/x86)

#3415 Real MIPS verifier oracle omits parsed GNU attribute…
- fix pull request #3478
#3402 Equivalent WASM MCP path spelling introduces false…
- fix pull request #3455
#3401 Unreadable reference source root loses its filesystem…
- fix pull request #3498 (draft)
#3398 An unrelated .go.buildinfo section blocks Rust…
- fix pull request #3454
#3397 Unnamed ELF read-only sections lose embedded Rust…
- fix pull request #3477
#3390 Mach-O export inspection merges names ending in…
- fix pull request #3457
#3387 Empty module specifier aborts the entire…
- fix pull request #3497 (draft)
#3384 Mach-O dependency inspection removes install-name…
- fix pull request #3430 (draft)
#3373 Keyed archive inspection returns hexadecimal XML…
- fix pull request #3475
#3365 Native-boundary inspection fails on a large metadata…
- fix pull request #3660
#3359 A regular Contents resource misclassifies a shallow…
- fix pull request #3505 (draft)
#3354 Reconstruction coverage reports ready with a missing…
- fix pull request #3802 (draft)
#3346 Dart AOT inspection reports complete coverage for…
- fix pull request #3859
#3343 UI action traces omit known Objective-C handlers for…
- fix pull request #3828 (draft)
#3335 analyze_function repeats the initial MCP progress…
- fix pull request #3460
#3334 Snapshot opens are overtaken by later MCP reads and…
- fix pull request #3661
#3331 WebMCP schema keywords appear as input field names
- fix pull request #3765
#3324 SQLite inspection reads the wrong database after a…
- fix pull request #3655
#3318 OpenCode V2 registration stays disabled after setup…
- fix pull request #3469

6. CLI, MCP Server, Transports & Process Lifecycles

#3408 Array and object tool parameters rejected when REA…
- fix pull request #3486
- fix pull request #3525
#3362 Reassigned child handles retain resolved signal and…
- fix pull request #3819
#3338 Process capture silently drops the accepted proto…
- fix pull request #3834
#3333 Distinct unresolved MCP workflows collide in the…
- fix pull request #3503
#3320 Hermes setup fails to register REA through an aliased…
- fix pull request #3785
#3303 Process capture reports a retargeted symlink as…
- fix pull request #3418

7. Static Bundle, Network Tracing & Endpoints

#3451 Static endpoint discovery omits template-literal,…
- fix pull request #3534

8. Archive Formats, Evidence Ledgers & Accounting

#3371 CDATA in XML keyed-archive keys truncates root and…
- fix pull request #3426
#3370 Reconstruction obligation ledgers lose semantic…
- fix pull request #3826 (draft)

9. Verification Oracles, Test Fixtures & CI

#3538 Parent-budget exhaustion after a static checkpoint…
- fix pull request #3545 (draft)
- fix pull request #3550

10. General Format & Parsing Deficiencies

#3391 Accepted scenario_start action creates duplicate…
- fix pull request #3493
#3385 Truncated accessibility trees falsely report…
- fix pull request #3824 (draft)
#3378 Malformed worker inventories are reported as empty
- fix pull request #3513
#3377 Selected console text drops null primitive arguments
- fix pull request #3479
#3376 Missing or malformed accessibility inventories are…
- fix pull request #3850
#3367 Replaced globals retain resolved built-in timer,…
- fix pull request #3849 (draft)
#3360 Unrelated this receivers share one resolved event…
- fix pull request #3857 (draft)
#3353 Unrelated LaunchDaemons ancestor mislabels a…
- fix pull request #3504 (draft)
#3349 Mobile application graphs classify known directories…
- fix pull request #3830 (draft)
#3330 Cutter discards mixed Unicode output that fits the…
- fix pull request #3776
#3314 Exact case-sensitive feature seeds conflate distinct…
- fix pull request #3803 (draft)
#3310 Noncomputed class method names create false resolved…
- fix pull request #3638

🤖 Generated with Claude Code (Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): Some open items on this list already have a fix waiting. Each one below has an open pull request that GitHub links as closing it. That is 62 of the 94 open items. Reviewing these may close bugs fastest. I checked each link live at 05:40 UTC on 15 October. I did not test these fixes for this list. A pull request marked "draft" is not ready yet. **1. Ghidra, Hopper & Native Decompilation Engines** - [ ] #3419 Setup offers automated Hopper installation on Linux… - fix pull request #3422 - [ ] #3396 Frida script-file Evidence loses original byte… - fix pull request #3507 - [ ] #3306 Doctor reports Hopper ready with an invalid startup… - fix pull request #3755 **2. Electron, JavaScript & Web Runtimes** - [ ] #3535 Electron reached through esbuild's `__require` shim is… - fix pull request #3596 - [ ] #3474 capture_electron_scenario active hook does not block… - fix pull request #3533 - fix pull request #3559 - [ ] #3453 capture_electron_scenario waits for the full 60 s… - fix pull request #3605 - [ ] #3452 capture_electron_scenario does not block… - fix pull request #3466 - fix pull request #3471 - [ ] #3414 Owned Electron capture drops the selected X11… - fix pull request #3544 - [ ] #3400 Overflowing JavaScript timer delays abort application… - fix pull request #3456 - fix pull request #3464 - [ ] #3392 Accepted long browser scenario waits and deadlines… - fix pull request #3515 - [ ] #3382 Electron script frame attribution and identity change… - fix pull request #3823 (draft) - [ ] #3380 Electron fuse inspection rejects absolute symlinks… - fix pull request #3587 - [ ] #3379 Electron inspection reports malformed CDP inventories… - fix pull request #3850 - [ ] #3358 Overwritten timer handles retain resolved cancellation… - fix pull request #3794 - [ ] #3350 Harmony projection omits JavaScript runtime hints for… - fix pull request #3627 - [ ] #3321 Trailing app-bundle separators select JavaScript… - fix pull request #3511 **3. Android, JADX, Dex & Mobile Tooling** - [ ] #3488 inspect_android_method returns neighbouring members as… - fix pull request #3527 - [ ] #3443 inspect_android_method reports an inlined Java method… - fix pull request #3450 - [ ] #3369 ADB push reports checksum capture overflow as device… - fix pull request #3458 - [ ] #3340 Apktool decode refusals report the launcher path… - fix pull request #3462 **4. .NET CLR, C# & Managed Metadata** - [ ] #3348 Managed member comparison reports changed method… - fix pull request #3814 **5. Native Binaries (Mach-O, PE, ELF, FAT, ARM64/x86)** - [ ] #3415 Real MIPS verifier oracle omits parsed GNU attribute… - fix pull request #3478 - [ ] #3402 Equivalent WASM MCP path spelling introduces false… - fix pull request #3455 - [ ] #3401 Unreadable reference source root loses its filesystem… - fix pull request #3498 (draft) - [ ] #3398 An unrelated .go.buildinfo section blocks Rust… - fix pull request #3454 - [ ] #3397 Unnamed ELF read-only sections lose embedded Rust… - fix pull request #3477 - [ ] #3390 Mach-O export inspection merges names ending in… - fix pull request #3457 - [ ] #3387 Empty module specifier aborts the entire… - fix pull request #3497 (draft) - [ ] #3384 Mach-O dependency inspection removes install-name… - fix pull request #3430 (draft) - [ ] #3373 Keyed archive inspection returns hexadecimal XML… - fix pull request #3475 - [ ] #3365 Native-boundary inspection fails on a large metadata… - fix pull request #3660 - [ ] #3359 A regular Contents resource misclassifies a shallow… - fix pull request #3505 (draft) - [ ] #3354 Reconstruction coverage reports ready with a missing… - fix pull request #3802 (draft) - [ ] #3346 Dart AOT inspection reports complete coverage for… - fix pull request #3859 - [ ] #3343 UI action traces omit known Objective-C handlers for… - fix pull request #3828 (draft) - [ ] #3335 analyze_function repeats the initial MCP progress… - fix pull request #3460 - [ ] #3334 Snapshot opens are overtaken by later MCP reads and… - fix pull request #3661 - [ ] #3331 WebMCP schema keywords appear as input field names - fix pull request #3765 - [ ] #3324 SQLite inspection reads the wrong database after a… - fix pull request #3655 - [ ] #3318 OpenCode V2 registration stays disabled after setup… - fix pull request #3469 **6. CLI, MCP Server, Transports & Process Lifecycles** - [ ] #3408 Array and object tool parameters rejected when REA… - fix pull request #3486 - fix pull request #3525 - [ ] #3362 Reassigned child handles retain resolved signal and… - fix pull request #3819 - [ ] #3338 Process capture silently drops the accepted __proto__… - fix pull request #3834 - [ ] #3333 Distinct unresolved MCP workflows collide in the… - fix pull request #3503 - [ ] #3320 Hermes setup fails to register REA through an aliased… - fix pull request #3785 - [ ] #3303 Process capture reports a retargeted symlink as… - fix pull request #3418 **7. Static Bundle, Network Tracing & Endpoints** - [ ] #3451 Static endpoint discovery omits template-literal,… - fix pull request #3534 **8. Archive Formats, Evidence Ledgers & Accounting** - [ ] #3371 CDATA in XML keyed-archive keys truncates root and… - fix pull request #3426 - [ ] #3370 Reconstruction obligation ledgers lose semantic… - fix pull request #3826 (draft) **9. Verification Oracles, Test Fixtures & CI** - [ ] #3538 Parent-budget exhaustion after a static checkpoint… - fix pull request #3545 (draft) - fix pull request #3550 **10. General Format & Parsing Deficiencies** - [ ] #3391 Accepted scenario_start action creates duplicate… - fix pull request #3493 - [ ] #3385 Truncated accessibility trees falsely report… - fix pull request #3824 (draft) - [ ] #3378 Malformed worker inventories are reported as empty - fix pull request #3513 - [ ] #3377 Selected console text drops null primitive arguments - fix pull request #3479 - [ ] #3376 Missing or malformed accessibility inventories are… - fix pull request #3850 - [ ] #3367 Replaced globals retain resolved built-in timer,… - fix pull request #3849 (draft) - [ ] #3360 Unrelated this receivers share one resolved event… - fix pull request #3857 (draft) - [ ] #3353 Unrelated LaunchDaemons ancestor mislabels a… - fix pull request #3504 (draft) - [ ] #3349 Mobile application graphs classify known directories… - fix pull request #3830 (draft) - [ ] #3330 Cutter discards mixed Unicode output that fits the… - fix pull request #3776 - [ ] #3314 Exact case-sensitive feature seeds conflate distinct… - fix pull request #3803 (draft) - [ ] #3310 Noncomputed class method names create false resolved… - fix pull request #3638 🤖 Generated with Claude Code (Opus 5.5) 🦊

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi commented

2026-10-17 21:01:57 +00:00

Author

Owner

@ogutdgn commented on GitHub (Oct 16, 2026):

Two listed issues have open PRs addressing them: #4216 for #4184 (SQLite selected-table reply budgets), and #4259 for #3885 (optional native-addon bindings). Both are ready for review and remain unmerged.

@ogutdgn commented on GitHub (Oct 16, 2026): Two listed issues have open PRs addressing them: #4216 for #4184 (SQLite selected-table reply budgets), and #4259 for #3885 (optional native-addon bindings). Both are ready for review and remain unmerged.

bsakaguchi referenced this issue

2026-10-17 21:10:18 +00:00

[PR #1313] [CLOSED] fix(symbols): exclude Objective-C bookkeeping from declaration inventories #2793

bsakaguchi referenced this issue

2026-10-31 00:39:57 +00:00

[GH-ISSUE #5607] [Bug] get_objc_classes counts imported Objective-C classes twice through GOT aliases #3400

bsakaguchi referenced this issue

2026-10-31 00:40:00 +00:00

[GH-ISSUE #5617] [Bug] get_objc_classes omits Hopper class labels from a stripped Objective-C binary #3405